hashicorp/packer · error

checksum for %s not found in SHA256SUMS

Error message

checksum for %s not found in SHA256SUMS

What it means

expectedZipSHA256FromSums scans every whitespace-separated line of the SHA256SUMS content for a line whose last field (with a leading '*' stripped for binary-mode digests) equals the target zip filename. If no line matches after scanning all lines, it throws this error meaning the checksum manifest does not contain an entry for the requested artifact.

Source

Thrown at provisioner/hcp-sbom/packer_release_fetch.go:195

	return err == nil
}

func expectedZipSHA256FromSums(sumsContent, fileName string) (string, error) {
	for _, line := range strings.Split(sumsContent, "\n") {
		fields := strings.Fields(strings.TrimSpace(line))
		if len(fields) < 2 {
			continue
		}
		candidateFileName := strings.TrimPrefix(fields[len(fields)-1], "*")
		if candidateFileName == fileName {
			hash := strings.ToLower(fields[0])
			if !isValidSHA256Hex(hash) {
				return "", fmt.Errorf("invalid SHA256 checksum format for %s in SHA256SUMS", fileName)
			}
			return hash, nil
		}
	}
	return "", fmt.Errorf("checksum for %s not found in SHA256SUMS", fileName)
}

func fileSHA256(path string) (string, error) {
	f, err := os.Open(path)
	if err != nil {
		return "", fmt.Errorf("failed to open %s for hashing: %w", path, err)
	}
	defer func() { _ = f.Close() }()

	h := sha256.New()
	if _, err := io.Copy(h, f); err != nil {
		return "", fmt.Errorf("failed hashing %s: %w", path, err)
	}

	return hex.EncodeToString(h.Sum(nil)), nil
}

// downloadPackerRelease fetches the latest stable Packer version from the

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Print the resolved version and filename (packer_<v>_<goos>_<goarch>.zip) and check it appears in the SHA256SUMS file at releases.hashicorp.com/packer/<v>/packer_<v>_SHA256SUMS.
2. Verify runtime.GOOS/runtime.GOARCH maps to a build published in the release index (check the version entry's 'builds' array in index.json).
3. Ensure the zip download and SHA256SUMS URL use the same version — both are derived from the same v in downloadPackerRelease, so a custom getReleaseBaseURL override or mirror may be serving inconsistent content.
4. Update/republish the full SHA256SUMS on any internal mirror.

Example fix

// before: requesting an unpublished platform
zipPath, err := downloadPackerRelease(ctx, "plan9", "amd64")

// after: gate on supported platforms
if goos != "linux" && goos != "darwin" && goos != "windows" {
    return "", fmt.Errorf("unsupported GOOS %q for Packer release download", goos)
}
zipPath, err := downloadPackerRelease(ctx, goos, goarch)

supported := map[string]bool{
    "linux/amd64": true, "linux/arm64": true, "linux/386": true,
    "darwin/amd64": true, "darwin/arm64": true,
    "windows/amd64": true, "windows/386": true,
}
if !supported[goos+"/"+goarch] {
    return fmt.Errorf("no published Packer build for %s/%s", goos, goarch)
}

func buildExistsInIndex(index releaseIndex, v, goos, goarch string) bool {
    rv, ok := index.Versions[v]
    if !ok {
        return false
    }
    want := fmt.Sprintf("packer_%s_%s_%s.zip", v, goos, goarch)
    for _, b := range rv.Builds {
        if b.Filename == want {
            return true
        }
    }
    return false
}

expectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)
if err != nil {
    if strings.Contains(err.Error(), "not found in SHA256SUMS") {
        return fmt.Errorf("platform %s/%s has no checksum entry for Packer %s; check releases index builds", goos, goarch, v)
    }
    return err
}

When it happens

Trigger: downloadPackerRelease builds fileName as packer_<v>_<goos>_<goarch>.zip and looks it up in packer_<v>_SHA256SUMS; the error fires when no line's filename matches — e.g. requesting a GOOS/GOARCH combination that has no published build (wrong os/arch), version mismatch between zip URL and checksums URL, or a partial/older SHA256SUMS file on a mirror.

Common situations: Running on an exotic GOOS/GOARCH (e.g. freebsd/riscv64) not covered by the release; typo'd or stale version string producing a checksums file that predates the build; internal mirror hosting trimmed checksum files; checksums file served for a different version than the zip.

Related errors

• empty response body for %s
• invalid SHA256 checksum format for %s in SHA256SUMS
• failed to resolve expected checksum: %w
• signing_mode %q does not support Sigstore bundle emission
• decode envelope payload: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/63d89bfb2c620765. Report an issue: GitHub.